AN EMPIRICAL INVESTIGATION OF EDP AUDIT JUDGMENTS AND CONSENSUS BETWEEN EXTERNAL AND INTERNAL AUDIT EXPERTS.

摘要

Within a computerized environment, traditional audit goals must be maintained. However, how these controls are implemented and evaluated is different than in a manual accounting system. To evaluate these computer controls requires a new type of auditor--a computer audit specialist (external) and EDP auditor (internal). In such a crucial area as computer controls, agreement between (consensus) and among (consistency) these auditors concerning computer controls is necessary to ensure the quality of the audit.; The evaluation of computer controls is subject to the judgment of the auditor. This study examined whether differences in consensus between external and internal auditors existed in the evaluation of computer controls. Auditors were asked to evaluate computer controls in three areas--separation of functions controls, program code change controls, and logical and physical security access controls.; The results of this study showed that neither group of auditors were more consistent in their judgments than the other group. However, the group of external auditors had greater consensus among themselves than the group of internal auditors.; Several variables were examined as possible explanatory factors that would account for the particular level of consensus within each of the auditor groups. For external auditors, differences in the level of consensus were explained by the auditor's management level. In addition, consensus level differences among external auditors were also attributed to the particular Big Eight firm to which an auditor belonged. For internal auditors, differences in consensus levels within the internal auditor group could not be attributed to experience, education background or management level.; Auditors were also asked to rank and weight the control questions within the questionnaire. Significant differences between external and internal auditors were found primarily in the logical and physical access control questions.; Previous studies have found higher consistency and consensus levels than this study. The nature of the task (evaluation of computer controls versus evaluation of a payroll or accounts receivable subsystem), may account for the lower consistency and consensus levels.; In conclusion, this study found that some differences exist between external and internal auditors in the evaluation of computer controls. In light of the "single audit" concept and increased reliance on the work of internal auditors, agreement among these auditors is important to ensure the quality of future EDP auditing.